The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content from external markdown files (improvement-plan-*.md) and merges it into agent instruction files (SKILL.md). A malicious plan could contain instructions designed to alter the agent's future behavior or bypass safety constraints. * Ingestion points: The skill reads markdown files following the pattern improvement-plan-{name}.md. * Boundary markers: The instructions lack explicit delimiters or warnings to treat suggested content as data rather than instructions. * Capability inventory: The skill uses Edit and Write tools to modify files and calls shell scripts for backup and verification tasks. * Sanitization: No sanitization or validation of the suggested content is performed before application.
[COMMAND_EXECUTION]: The skill executes local bash scripts (backup-skill.sh and verify-update.sh) to manage the update lifecycle. These scripts perform filesystem operations including recursive copying and directory creation. While these are intended functions, the script execution surface could be targeted if malicious or unexpected paths are provided via the improvement plan.

skill-improver